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CLAIMS 

1 . (Amended) A failure sensing device of a vehicle control system including a 
control unit (100, 110, 120) generating a control target based on an operation request 

5 for controlling a driving state of a vehicle by manipulating a corresponding actuator 
using the generated control target, and a processing unit (200, 300) connected to said 
control unit (100, 1 10, 120) by a network, for generating and providing to said control 
unit (100, 1 10, 120) additional information to be used to modify said operation request 
or said control target, as necessary, at said control unit (100, 110, 120), wherein 
10 SEiid failure sensing device is provided to said control unit (100, 110, 120) with 

smaller control load, and includes 

an output portion outputting information to said processing unit (200, 300) with 
greater control load, 

a receiving portion receiving a response corresponding to said information from 
15 said processing unit (200, 300), and 

a sensing portion sensing a failure in said processing unit (200, 300) based on 
said information and said response. 

2. The failure sensing device according to claim 1, wherein 

20 said information is input data for calculation at said processing unit (200, 300), 

and 

said receiving portion receives as a response a calculation result of said input 
data substituted into a predetermined calculation formula at said processing unit (200, 
300). 

25 

3. The failure sensing device according to claim 1, wherein 

said control unit (100, 110, 120) further includes a diagnosing portion 
diagnosing a failure in itself 
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4. The failure sensing device according to claim 1, wherein 

said control Unit (100, 110, 120) is configured by multiplexed calculating units. 

5. The failure sensing device according to claim 1, wherein 

said control unit (100, 110, 120) further includes a determining portion 
determining interruption of control in which additional information from said processing 
unit (200, 300) is reflected, when a failure of said processing unit (200, 300) is sensed 
by said sensing portion. 

6. The failure sensing device according to claim 1, wherein 

said control unit (100, 110, 120) is configured by a plurality of control units (100, 
110, 120) controlling an operation of a vehicle, and 

said control unit (100, 110, 120) further includes a sensing portion sensing a 
failure in said processing unit (200, 300) based on a plurality of sensing results fi-om 
sensing portions included in said plurality of control units (100, 110, 120). 

7. The failure sensing device according to claim 6, wherein 

priorities as to failure sensing are assigned to said plurality of control units (100, 
110, 120). 

8. The failure sensing device according to claim 7, wherein 

control units (100, 110, 120) with smaller control loads are given higher 
priorities. 

9. (Amended) A failure sensing device of a vehicle control system including a 
control unit (100, 110, 120) generating a control target based on an operation request 
for controlling a driving state of a vehicle by manipulating a corresponding actuator 
using the generated control target, and a processing unit (200, 300) connected to said 
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control unit (100, 110, 120) by a network, for generating and providing to said control 
unit (100, 110, 120) additional information to be used to modify said operation request 
or said control target, as necessary, at said control unit (100, 110, 120), wherein 

said failure sensing device is provided to said control unit (100, 110, 120) with 
5 smaller control load, and includes 

an output portion outputting information to said processing unit (20O, 300) v^th 
greater control load, 

a receiving portion receiving a response corresponding to said information from 
said processing unit (200, 300), and 
10 a sensing portion sensing a failure in said processing unit (200, 300) based on 

said information and said response, wherein 

units in said vehicle control system are hierarchically configured, and 

said control unit (100, 110, 120) is arranged hierarchically lower than said 
processing unit (200, 300). 

15 

10. (Amended) A failure sensing device of a vehicle control system including a 
control unit (100, 110, 120) generating a control target based on an operation request 
for controlling a driving state of a vehicle by manipulating a corresponding actuator 
using the generated control target, and a processing unit (200, 300) connected to said 
20 control unit (100, 110, 120) by a network, for generating and providing to S£ud control 
unit (100, 110, 120) additional information to be used to modify said operation request 
or said control target, as necessary, at said control unit (100, 110, 120), wherein 

said failure sensing device is provided to said control unit (100, 110, 120) with 
smaller control load, and includes 
25 outputting means for outputting information to said processing unit (200, 300) 

with greater control load, 

receiving means for receiving a response corresponding to said information from 
said processing unit (200, 300), and 
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sensing means for sensing a failure in said processing unit (200, 300) based on 
said information and said response. 

11. The failure sensing device according to claim 10, wherein 

said information is input data for calculation at said processing unit (200, 300), 

and 

said receiving means includes means for receiving as a response a calculation 
result of said input data substituted into a predetermined calculation formula at said 
processing unit (200, 300). 

12. The failure sensing device according to claim 10, wherein 

said control unit (100, 110, 120) further includes diagnosing means for 
diagnosing a failure in itself. 

13. The failure sensing device according to claim 10, wherein 

said control unit (100, 110, 120) is configured by multiplexed calculating units. 

14. The failure sensing device according to claim 10, wherein 

said control unit (100, 110, 120) further includes means for determining 
interruption of control in which additional information from said processing unit (200, 
300) is reflected, when a failure of said processing unit (200, 300) is sensed by said 
sensing means. 

15. The failure sensing device according to claim 10, wherein 

said control unit (100, 110, 120) is configured by a plurality of control units (100, 
1 10, 120) controlling an operation of a vehicle, and 

said control unit (100, 110, 120) further includes means for sensing a failure in 
said processing unit (200, 300) based on a plurality of sensing results from sensing 
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means included in said plurality of control units (100, 110, 120). 

16. The failure sensing device according to claim 15, wherein 

priorities as to failure sensing are assigned to said plurality of control units (100, 
110, 120). 

17. The failure sensing device according to claim 16, wherein 
control units (100, 110, 120) with smaller control loads are given higher 

priorities. 

1 8. (Amended) A failure sensing device of a vehicle control system including a 
control unit (100, 110, 120) generating a control target based on an operation request 
for controlling a driving state of a vehicle by manipulating a corresponding actuator 
using the generated control target, and a processing unit (200, 300) connected to said 
control unit (100, 1 10, 120) by a network, for generating and providing to said control 
unit (100, 110, 120) additional information to be used to modify said operation request 
or said control target, as necessary, at said control unit (100, 110, 120), wherein 

said failure sensing device is provided to said control unit (100, 1 10, 120) with 
smaller control load, and includes 

outputting means for outputting information to said processing unit (200, 300) 
with greater control load, 

receiving means for receiving a response corresponding to said information from 
said processing unit (200, 300), and 

sensing means for sensing a failure in said processing unit (200, 300) based on 
said information and said response, wherein 

units in said vehicle control system are hierarchiczdly configured, and 

said control unit (100, 110, 120) is arranged hierarchically lower than said 
processing unit (200, 300). 
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